fork(1) download
  1. set line {
  2. Jul 24 21:06:40 2014: %AUTH-6-INFO: login[1765]: user 'admin' on 'pts/1' logged
  3. Jul 24 21:05:15 2014: %DATAPLANE-5-: Unrecognized HTTP URL www.58.net. Flow: 0x2
  4. Jul 24 21:04:39 2014: %DATAPLANE-5-: Unrecognized HTTP URL static.58.com. Flow:
  5. Jul 24 21:04:38 2014: %DATAPLANE-5-: Unrecognized HTTP URL www.google-analytics.
  6. com. Flow: 0x2265394048.
  7. Jul 24 21:04:36 2014: %DATAPLANE-5-: Unrecognized HTTP URL track.58.co.in. Flow: 0
  8. Jul 24 21:04:38 2014: %DATAPLANE-5-:Unrecognized HTTP URL www.google.co.in. Flow: 0x87078800
  9. Jul 24 21:04:38 2014: %DATAPLANE-5-:CCB:44:Unrecognized Client Hello ServerName www.google.co.in. Flow: 0x87073880. len_analyzed: 183
  10. Jul 24 21:04:38 2014: %DATAPLANE-5-:CCB:44:Unrecognized Server Hello ServerName test1. Flow: 0x87073880, len_analyzed 99
  11. Jul 24 21:04:38 2014: %DATAPLANE-5-:CCB:44:Unrecognized Server Cert CommonName *.google.com. Flow: 0x87073880
  12. Jul 24 21:04:38 2014: %DATAPLANE-5-:CCB:44:Searching rname(TYPE_A) cs50.wac.edgecastcdn.net in dns_hash_table
  13. Jul 24 21:04:38 2014: %DATAPLANE-5-:Unrecognized HTTP URL www.facebook.com. Flow: 0x87078800
  14. Jul 24 21:04:38 2014: %DATAPLANE-5-:CCB:44:Unrecognized Client Hello ServerName www.fb.com. Flow: 0x87073880. len_analyzed: 183
  15. Jul 24 21:05:38 2014: %DATAPLANE-5-:CCB:44:Unrecognized Server Hello ServerName test. Flow: 0x87073880, len_analyzed 99
  16. Jul 24 21:04:38 2014: %DATAPLANE-5-:CCB:44:Unrecognized Server Cert CommonName *.facebook.com. Flow: 0x87073880
  17. Jul 24 21:05:39 2014: %DATAPLANE-5-:CCB:44:Searching rname(TYPE_A) cs50.wac.facebook.net in dns_hash_table
  18. }
  19.  
  20. set URL [list]
  21. set chs [list]
  22. set shs [list]
  23. set scs [list]
  24. set rname [list]
  25. set cURL 0
  26. set cchs 0
  27. set cshs 0
  28. set cscs 0
  29. set crname 0
  30. foreach {whole type payload} [regexp -all -inline {(?x)
  31. \y ( URL
  32. | (?: Client | Server)[ ]Hello[ ]ServerName
  33. | Server[ ]Cert[ ]CommonName
  34. | rname\([^)]+\) )
  35. \s+ ((?:(?![ ]Flow:| in[ ]dns_hash_table).)+)
  36. } $line] {
  37. switch -regexp $type {
  38. URL {lappend URL $payload; incr cURL}
  39. {Client Hello ServerName} {lappend chs $payload; incr cchs}
  40. {Server Hello ServerName} {lappend shs $payload; incr cshs}
  41. {Server Cert CommonName} {lappend scs $payload; incr cscs}
  42. {rname\([^)]+\)} {lappend rname $payload; incr crname}
  43. }
  44. }
  45.  
  46. set max [lindex [lsort -decreasing [list $cURL $cchs $cshs $cscs $crname]] 0]
  47. set i 0
  48. set all_list [list]
  49.  
  50. while {$max != $i} {
  51. if {[catch {regsub -all {\s} [lindex $URL $i] "" one}]} {set one ""}
  52. if {[catch {regsub -all {\s} [lindex $chs $i] "" two}]} {set two ""}
  53. if {[catch {regsub -all {\s} [lindex $shs $i] "" three}]} {set three ""}
  54. if {[catch {regsub -all {\s} [lindex $scs $i] "" four}]} {set four ""}
  55. if {[catch {regsub -all {\s} [lindex $rname $i] "" five}]} {set five ""}
  56. lappend all_list [join [list $one $two $three $four $five] ,]
  57. incr i
  58. }
  59. puts [join $all_list \n]
Success #stdin #stdout 0.04s 5348KB
stdin
Standard input is empty
stdout
www.58.net.,www.google.co.in.,test1.,*.google.com.,cs50.wac.edgecastcdn.net
static.58.com.,www.fb.com.,test.,*.facebook.com.,cs50.wac.facebook.net
www.google-analytics.com.,,,,
track.58.co.in.,,,,
www.google.co.in.,,,,
www.facebook.com.,,,,